@coffre/db 0.14.4 → 0.15.0

package/dist/log-DaD7fyUq.d.ts

@@ -0,0 +1,722 @@
+import { a as Queryable, o as Transaction } from "./database-CVteLhp1.js";
+import { Placeholder, SQL, SQLWrapper } from "drizzle-orm";
+import { LogKey, StoredEntry } from "@coffre/core/audit";
+import { PreparedChange } from "@coffre/core/vault";
+//#region src/change-records.d.ts
+/**
+ * What a change of 0.15's log records besides its op, which the audit pages
+ * list where 0.14's entry stood (D147): a sign-in through a trust binding
+ * (`signIn`, T156); a token the vault issued (`issue`); a credential it
+ * revoked by request, or that signed itself out (a revoke's `reason`,
+ * T164). Each is known by text its payload holds (`holds`), and by how the
+ * payload starts (`starts`): the vault writes it canonical, its keys in
+ * order, so an issue's is `{"caller":…` and a revoke's
+ * `{"op":"credential.revoke",…`. A string the payload holds has its quotes
+ * escaped, but an object's keys need not be the vault's own (a role's
+ * name, in the roles' change: review r1), so where the text alone could be
+ * one, the start says whose payload it is. The partial indexes of
+ * `log_changes` hold each set, and a read that is to use one repeats its
+ * condition (`recorded`), word for word and with no parameter.
+ */
+declare const RECORDS: {
+  readonly signIn: {
+    readonly holds: "\"signIn\":{";
+  };
+  readonly issue: {
+    readonly starts: "{\"caller\":\"";
+    readonly holds: "\"issue\":{\"by\":\"";
+  };
+  readonly revoke: {
+    readonly starts: "{\"op\":\"credential.revoke\",";
+    readonly holds: "\"reason\":\"revoke\"";
+  };
+  readonly signOut: {
+    readonly starts: "{\"op\":\"credential.revoke\",";
+    readonly holds: "\"reason\":\"sign_out\"";
+  };
+};
+type ChangeRecord = keyof typeof RECORDS;
+/** Whether `payload` holds one of `records`, on Postgres or SQLite: an index's condition, and the reads' that use it. */
+declare function recorded(engine: 'postgres' | 'sqlite', payload: SQLWrapper, ...records: ChangeRecord[]): SQL;
+//#endregion
+//#region src/log.d.ts
+/**
+ * Appending to the audit log, the one table both the app and the vault
+ * write, each under its own key (@coffre/core/audit says what an entry's MAC
+ * and hash cover).
+ *
+ * Every append locks the log's head first, `audit_chain_head`, so entries
+ * from any process take their numbers in one order. It then reads the
+ * database clock, after the lock, and the log's last entry, which the head
+ * must name: a head that does not was moved, or entries were deleted behind
+ * it, and the append refuses. The same statement says whether the log has
+ * moved on from the key it appends under (`KeyRetired`).
+ *
+ * This is deliberately not a queue and not best-effort: the entries go in
+ * the caller's transaction, so if the append fails, what it records does
+ * not happen either.
+ */
+/** An entry to append: what it says. The append numbers, dates, signs and chains it. */
+type NewEntry = {
+  actor: string;
+  action: string;
+  decision: 'allow' | 'deny';
+  code?: string | null;
+  subjectPrincipal?: string | null;
+  projectId?: string | null;
+  environmentId?: string | null;
+  secretId?: string | null;
+  secretVersionId?: string | null;
+  operationId?: string | null;
+  requestId?: string | null;
+  sourceIp?: string | null;
+  relatedSeq?: bigint | null;
+  /** JSON text. */
+  metadata?: string;
+};
+type Appended = {
+  /** The first entry's number, and the next number after the last. */
+  seqStart: bigint;
+  nextSeq: bigint;
+  headHash: Buffer;
+  /** Milliseconds since the epoch, the database's, shared by the batch. */
+  occurredAt: number;
+};
+/** The log's head does not name its last entry: something moved it, or cut the log behind it. */
+declare class LogHeadMismatch extends Error {
+  constructor(message: string);
+}
+/**
+ * As many transactions as may already wait for the log's head do
+ * (`lockLogHeadQueued`): this one waits for nothing, and holds nothing.
+ * Its code is Postgres's for a lock not available, so every caller already
+ * answers it as one that gave up waiting: unavailable, ask again shortly.
+ */
+declare class HeadBusy extends Error {
+  readonly code = "55P03";
+  constructor();
+}
+/**
+ * The log's head is behind one this process wrote: the database was rolled
+ * back, or entries were cut off its end. That cannot be told from a restore,
+ * so the append refuses and someone has to look.
+ */
+declare class LogRewound extends Error {
+  constructor(message: string);
+}
+/**
+ * An append under a key the log has moved on from: an entry of its
+ * author's, `key.reseal` or `key.rotate`, names it as the key it moves
+ * from (`MOVES_FROM`), and a key moved from writes no more.
+ */
+declare class KeyRetired extends Error {
+  constructor(message: string);
+}
+/**
+ * The actions by which an author moves to a new key, each under the new one
+ * and naming the key it moves from as its subject: from the first, that key
+ * writes no more (`KeyRetired`). The app's key rotation writes them
+ * (packages/server/src/key-rotation.ts).
+ */
+declare const MOVES_FROM: readonly ["key.reseal", "key.rotate"];
+/**
+ * Forget every head written so far. For tests that empty the database
+ * between cases, which is exactly what the check above refuses.
+ */
+declare function forgetLogHeads(): void;
+/**
+ * Lock the log's head, and read it. A transaction that appends takes this
+ * before any other row, so the lock order is the same everywhere; taking it
+ * again in the same transaction is free.
+ */
+declare function lockLogHead(tx: Transaction): Promise<{
+  nextSeq: bigint;
+  headHash: Buffer;
+}>;
+/**
+ * Take the issue lock exclusive (migration 0026's, `1668244070, 1`): every
+ * issue in flight, a sign-in or a token's, ends first, and none starts
+ * until this transaction does. A write that moves what an issue's policy
+ * check compares (`issue_token`: the policy, a protected environment's
+ * slug) takes it, after its own rows and before the fence its append's
+ * trigger takes, as the checkpointer's barrier does: so the issue is
+ * ordered against it, and no use waits behind an issue (formal/Lifecycle.tla's
+ * IssuePolicyHeld, Migration015.tla's PolicyIssueFirst; T149, review r3).
+ * SQLite's transactions hold the whole file.
+ */
+declare function holdIssues(tx: Transaction): Promise<void>;
+/**
+ * The issue lock shared, then 0.15's fence exclusive (`1668244070, 0`), as
+ * 0.14's trigger takes them for an entry that changes access: what 0.15's
+ * cutover holds, its member rows and 0.14's head taken first, so that its
+ * own 0.14 entry's trigger waits on nothing (formal/Migration015.tla,
+ * CutoverIssueFirst; T132). Every use and every change waits for its
+ * commit; the checkpointer's barrier, which takes the issue lock exclusive
+ * first, too. SQLite's transactions hold the whole file.
+ */
+declare function holdFence(tx: Transaction): Promise<void>;
+/**
+ * Lock the log's head if no one holds it, without waiting: whether it is
+ * held now. For work any caller may do, of which one at a time is enough,
+ * which a request that finds the head taken leaves to the one that has it.
+ * SQLite's transactions hold the whole file, so the head is always free.
+ */
+declare function lockLogHeadIfFree(tx: Transaction): Promise<boolean>;
+/**
+ * Lock the log's head, waiting for it as `lockLogHead` does, if fewer than
+ * `waiters` other transactions hold one of its places in line; otherwise
+ * refuse at once (`HeadBusy`), having waited for nothing. A place is an
+ * advisory lock, tried, never waited for, and held to the end of the
+ * transaction, which holds the head by then: so at most `waiters`
+ * connections wait for the head, or hold it, through here, and a burst
+ * beyond them answers in one round trip rather than seconds later, holding
+ * a connection all the while. One statement: the place, then, only if one
+ * was free, the head; refused, one more says whether the head is there at
+ * all. SQLite's transactions hold the whole file.
+ */
+declare function lockLogHeadQueued(tx: Transaction, waiters: number): Promise<{
+  nextSeq: bigint;
+  headHash: Buffer;
+}>;
+/**
+ * Append `entries` under `key`. `check`, when given, runs once the head is
+ * locked and before anything is written: a writer's own condition on the
+ * log as it stands, which no other append can change until this one
+ * commits. It throws to refuse.
+ */
+declare function appendEntries(tx: Transaction, key: LogKey, entries: readonly NewEntry[], check?: (tx: Transaction) => Promise<void>,
+/**
+ * The head as a statement of the caller's locked it, with the log's last
+ * entry and the clock as that statement read them once it held the lock:
+ * nothing to read again.
+ */
+locked?: HeldHead,
+/**
+ * 0.15's changes of the app's write these entries record (`appChanges`):
+ * on Postgres, made in the append's own statement, one round trip less
+ * under the head, which every sign-in waits for (T123). Their numbers
+ * come back as `changes`.
+ */
+changes?: readonly PreparedChange[],
+/**
+ * Whether the writer runs under 0.15's log: its entries carry `log015`,
+ * which no MAC covers and 0.14's code never sets. Once the log is cut
+ * over, migration 0047's trigger refuses a write's entry without it.
+ */
+log015?: boolean): Promise<Appended & {
+  changes: (bigint | null)[];
+}>;
+/** A head locked by a statement of the caller's, and what it read under the lock (`appendEntries`). */
+type HeldHead = {
+  head: {
+    nextSeq: bigint;
+    headHash: Buffer;
+  };
+  last: {
+    seq: bigint;
+    hash: Buffer;
+  } | null;
+  at: number;
+};
+/** An entry's columns, as the chain's codec reads them (`StoredEntry`). */
+declare function entryColumns(db: Queryable): {
+  seq: import("drizzle-orm/pg-core").PgColumn<{
+    name: "seq";
+    tableName: "audit_log";
+    dataType: "bigint";
+    columnType: "PgBigInt64";
+    data: bigint;
+    driverParam: string;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: true;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  author: import("drizzle-orm/pg-core").PgColumn<{
+    name: "author";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  keyId: import("drizzle-orm/pg-core").PgColumn<{
+    name: "key_id";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  occurredAt: import("drizzle-orm/pg-core").PgColumn<{
+    name: "occurred_at";
+    tableName: "audit_log";
+    dataType: "number";
+    columnType: "PgBigInt53";
+    data: number;
+    driverParam: string | number;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  actor: import("drizzle-orm/pg-core").PgColumn<{
+    name: "actor";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  action: import("drizzle-orm/pg-core").PgColumn<{
+    name: "action";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  decision: import("drizzle-orm/pg-core").PgColumn<{
+    name: "decision";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  code: import("drizzle-orm/pg-core").PgColumn<{
+    name: "code";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  subjectPrincipal: import("drizzle-orm/pg-core").PgColumn<{
+    name: "subject_principal";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  projectId: import("drizzle-orm/pg-core").PgColumn<{
+    name: "project_id";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgUUID";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  environmentId: import("drizzle-orm/pg-core").PgColumn<{
+    name: "environment_id";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgUUID";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  secretId: import("drizzle-orm/pg-core").PgColumn<{
+    name: "secret_id";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgUUID";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  secretVersionId: import("drizzle-orm/pg-core").PgColumn<{
+    name: "secret_version_id";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgUUID";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  operationId: import("drizzle-orm/pg-core").PgColumn<{
+    name: "operation_id";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgUUID";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  requestId: import("drizzle-orm/pg-core").PgColumn<{
+    name: "request_id";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  sourceIp: import("drizzle-orm/pg-core").PgColumn<{
+    name: "source_ip";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  relatedSeq: import("drizzle-orm/pg-core").PgColumn<{
+    name: "related_seq";
+    tableName: "audit_log";
+    dataType: "bigint";
+    columnType: "PgBigInt64";
+    data: bigint;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  metadata: import("drizzle-orm/pg-core").PgColumn<{
+    name: "metadata";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: true;
+    hasDefault: true;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  prevHash: import("drizzle-orm/pg-core").PgColumn<{
+    name: "prev_hash";
+    tableName: "audit_log";
+    dataType: "custom";
+    columnType: "PgCustomColumn";
+    data: Buffer<ArrayBufferLike>;
+    driverParam: unknown;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {
+    pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+  }>;
+  mac: import("drizzle-orm/pg-core").PgColumn<{
+    name: "mac";
+    tableName: "audit_log";
+    dataType: "custom";
+    columnType: "PgCustomColumn";
+    data: Buffer<ArrayBufferLike>;
+    driverParam: unknown;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {
+    pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+  }>;
+  hash: import("drizzle-orm/pg-core").PgColumn<{
+    name: "hash";
+    tableName: "audit_log";
+    dataType: "custom";
+    columnType: "PgCustomColumn";
+    data: Buffer<ArrayBufferLike>;
+    driverParam: unknown;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {
+    pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+  }>;
+};
+/**
+ * Metadata a reader of many entries holds at once, at most: an entry about
+ * a read of several secrets lists them, a thousand some 150 kilobytes, so a
+ * count of entries alone does not bound a batch's or a page's memory within
+ * a Worker's 128 megabytes.
+ */
+declare const BATCH_BYTES: number;
+/**
+ * Of the entries `where` matches, in `order` of seq, the first `limit` or
+ * fewer that hold no more than `BATCH_BYTES` of metadata between them, but
+ * always the first: the seqs they run from and to, and whether the bytes
+ * cut the run short of `limit`. Null when none matches. A reader asks this
+ * first, then reads `where` between the two.
+ */
+declare function withinBytes(db: Queryable, where: SQL | undefined, limit: number, order?: 'asc' | 'desc'): Promise<{
+  from: bigint;
+  to: bigint;
+  cut: boolean;
+  count: number;
+} | null>;
+/**
+ * The first entry missing from the log up to `seq`, and the one found in
+ * its place, or null when every one is there. Seqs are the primary key, so
+ * a stretch is whole exactly when its count is its length: one pass over
+ * the key's index, never the entries. Only a log with a gap pays for more,
+ * a count per halving to find where.
+ *
+ *   entries 0..9, 4 cut:  { expected: 4n, found: 5n }
+ */
+declare function missingEntry(db: Queryable, seq: bigint): Promise<{
+  expected: bigint;
+  found: bigint | null;
+} | null>;
+/**
+ * How a reader tells the vault's own entries from those forged in its name:
+ * by their MAC, which only the vault holds the key to check. Each it finds
+ * forged goes to `forged`.
+ */
+type Authenticity = {
+  authentic: (entry: StoredEntry) => boolean;
+  forged: (entry: StoredEntry) => void;
+};
+/** Up to `limit` of the entries in the vault's name, allowed, of one `action`, before `before` (the newest when undefined), newest first. */
+declare function newestVaultEntries(db: Queryable, action: string, limit: number, before?: bigint): Promise<StoredEntry[]>;
+/**
+ * The number of the newest entry in the vault's name, allowed, of one
+ * `action`, or null for none: whether one was appended since, and nothing
+ * of what it says, so its MAC is not checked. One indexed read.
+ */
+declare function newestVaultSeq(db: Queryable, action: string): Promise<bigint | null>;
+/**
+ * `newestVaultSeq`'s query, to run or to read inside another, as a
+ * credential's read takes the newest `policy.change` with it: one rule for
+ * what the newest is, wherever it is read.
+ */
+declare function newestSeqQuery(db: Queryable, action: string | Placeholder): Omit<import("drizzle-orm/pg-core").PgSelectBase<"audit_log", {
+  seq: import("drizzle-orm/pg-core").PgColumn<{
+    name: "seq";
+    tableName: "audit_log";
+    dataType: "bigint";
+    columnType: "PgBigInt64";
+    data: bigint;
+    driverParam: string;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: true;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+}, "partial", Record<"audit_log", "not-null">, false, "where" | "orderBy" | "limit", {
+  seq: bigint;
+}[], {
+  seq: import("drizzle-orm/pg-core").PgColumn<{
+    name: "seq";
+    tableName: "audit_log";
+    dataType: "bigint";
+    columnType: "PgBigInt64";
+    data: bigint;
+    driverParam: string;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: true;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+}>, "where" | "orderBy" | "limit">;
+/** How many entries in its name the vault reads back, a page at a time, for its own newest of a kind (`newestAuthentic`). */
+declare const LOOK_BACK: {
+  page: number;
+  pages: number;
+};
+/** What `newestAuthentic` finds: the entry, or why there is none. */
+type Newest = StoredEntry | 'none' | 'forged' | 'unreached';
+/**
+ * The newest of the entries `page` reads, newest first and before a seq,
+ * that `check` finds authentic: the newest alone first, which it is unless
+ * entries were forged in the vault's name since, then back a page at a
+ * time. 'none' when there are none at all, 'forged' when every one is in
+ * the vault's name but not its own, and 'unreached' once it has read
+ * LOOK_BACK such entries (1024), whether or not more are left.
+ */
+declare function newestAuthentic(page: (limit: number, before: bigint | undefined) => Promise<StoredEntry[]>, check: Authenticity): Promise<Newest>;
+/**
+ * The app's changes to the objects its rows hold, as the vault sealed them
+ * (`Vault.prepare`), each `app_change` (migrations 0025, 0026 and 0030), in its
+ * transaction, once its rows and 0.14 entries are written: in order, in one
+ * round trip, or in the append's own (`appendEntries`). Each entry's number;
+ * 0 for a row of 0.14's, which logs nothing; null where a row's seal moved
+ * since the app read it, and nothing was done (ChangeCAS: read again). A row
+ * that is not its object's newest change's fails the call (`isStaleChange`),
+ * and its transaction with it.
+ *
+ * On SQLite, which has no functions, the same steps in the transaction,
+ * which holds the database's one write lock: the fence is implicit there
+ * (0.15's plan, "Postgres serves; SQLite is for tests").
+ */
+declare function appChanges(tx: Transaction, calls: readonly PreparedChange[]): Promise<(bigint | null)[]>;
+/**
+ * An object's key in 0.15's log, `log_changes.object`: the first 16 bytes
+ * of SHA-256 over its kind and id, as a uuid (`log_object` in SQL). The
+ * vault's (`objectKey`), and the app's, which finds a credential's sign-in
+ * by it.
+ */
+declare function logObject(kind: string, id: string): string;
+/** Whether `error` is `app_change`'s refusal of a row that is not its object's newest change's: Postgres's `data_corrupted`. */
+declare function isStaleChange(error: unknown): boolean;
+//#endregion
+export { ChangeRecord as A, logObject as C, newestVaultEntries as D, newestSeqQuery as E, recorded as M, newestVaultSeq as O, lockLogHeadQueued as S, newestAuthentic as T, holdFence as _, HeldHead as a, lockLogHead as b, LogHeadMismatch as c, NewEntry as d, Newest as f, forgetLogHeads as g, entryColumns as h, HeadBusy as i, RECORDS as j, withinBytes as k, LogRewound as l, appendEntries as m, Authenticity as n, KeyRetired as o, appChanges as p, BATCH_BYTES as r, LOOK_BACK as s, Appended as t, MOVES_FROM as u, holdIssues as v, missingEntry as w, lockLogHeadIfFree as x, isStaleChange as y };